TP-Link Tapo P100 Smart Plug

```

Device Name	TP-Link Tapo P100 Mini Smart Wi-Fi Socket
Brand	TP-Link
Type	Smart Plug / Home Automation
Released	2021
Current Firmware	Regular OTA updates via Tapo app

Device Category

Criterion	Score	Justification
Known hardware tampering	1 (None)	Smart plug has minimal physical attack value. Disassembly provides little security advantage. Bitdefender Hardware Analysis
Known vulnerabilities	2 (Rare)	Documented vulnerabilities include improper certificate validation allowing MITM attacks (CVE-2025-15557) and password hash leak via local network API (CVE-2025-14553). Both patched in latest firmware. CVE-2025-15557 Security Advisory, CVE-2025-14553 Security Advisory
Prior attacks	1 (None)	Smart plugs have not been used in large-scale botnet campaigns. They are not a primary target due to limited processing power. Botnet Target Analysis
Updatability	1 (Very common)	TP-Link pushes regular OTA firmware updates to Tapo devices via the mobile app. Security vulnerabilities are patched promptly. TP-Link Security Center

Device Category Score: 2

Criterion	Score	Justification
Authentication with other systems	2 (Partial)	Cloud communications require Tapo account authentication, but local API has historically had weak authentication. CVE-2025-14553 exposed password hashes via unauthenticated local API. Local API Vulnerability
Communications	2 (Encrypted with obsolete encryption)	Cloud communications use TLS, but CVE-2025-15557 showed improper certificate validation allowing man-in-the-middle attacks on the same network. MITM Vulnerability
Storage	3 (Not encrypted)	Plug stores minimal configuration data. No sensitive user data stored locally beyond Wi-Fi credentials and device settings. IoT Storage Security Research

System Category Score: 3

Criterion	Score	Justification
Account management	2 (Basic)	Tapo app supports basic user management and device sharing, but permission controls are limited. No role-based access. TP-Link Account Management
Authentication	2 (Basic)	Password-based authentication. Two-factor authentication available but not mandatory. Smart Home Account Security
Brute-force protection	2 (Basic)	Cloud accounts have basic rate limiting. Local API had no protection before CVE-2025-14553 was patched. Brute-force Protection
Event logging	2 (Partial logging)	App provides basic on/off history and device activity logs. No detailed security event logs exposed to users. Bitdefender Logging Analysis
Passwords	2 (Require change after setup)	Users must set a Tapo account password during device setup. Complexity requirements are moderate. Password Policy

User Authentication Category Score: 2

GRAS Total: 7

Final Grade: C (Moderate Danger Level)

```